IDOR via JWT Claim Manipulation

1const jwt = require('jsonwebtoken');
2
3app.get('/api/admin/users', (req, res) => {
4    const token = req.headers.authorization?.split(' ')[1];
5    
6    // Decode without verification
7    const decoded = jwt.decode(token);
8    
9    if (decoded.role !== 'admin') {
10        return res.status(403).json({ error: 'Admin access required' });
11    }
12    
13    // Return all users
14    const users = db.users.find({});
15    res.json(users);
16});